Legal
Privacy policy
Last updated 27 October 2026
This policy explains what Trace collects about people who use it and about people who appear in search results, why, and what choices they have.
If you use Trace
- Account: your email address and sign-in records, held by our authentication provider Supabase.
- Searches and reports: what you searched for, the candidate profiles shown, and the reports you unlock. Searches and reports are deleted automatically after 30 days.
- Payments: handled by Paddle. We receive the plan, amount, country and a Paddle customer ID — never your full card number.
- Security: your IP address is used, in hashed form, to limit abuse (for example how many searches a guest can run). Cloudflare Turnstile checks that requests come from a person.
- Referrals: if you arrived through a partner link we keep a pseudonymous visitor ID for up to 30 days so the partner can be credited.
If you appear in search results
Trace looks up public profiles and public web pages when a user searches. We store what is found inside that user's search session and report for up to 30 days, then delete it. We exclude people-search and data-broker websites, and our AI summaries are instructed never to mention health, religion, ethnicity, sexuality, politics, immigration status, criminal history, home addresses or phone numbers. You can ask us to exclude your profiles at any time using the removal request form; we keep only a one-way hash of the excluded links so we can keep filtering them.
Why we process data
To provide the service you asked for (contract), to keep the service secure and prevent abuse (legitimate interests), to meet tax and accounting rules (legal obligation), and — for people who appear in results — our legitimate interest and that of our users in finding publicly available information, balanced by the safeguards above and the right to object.
Who processes data for us
- Supabase — database and authentication
- Vercel — hosting
- Apify — runs the public-data lookups
- Google (YouTube Data API) and Gravatar — public profile lookups
- Anthropic — writes the AI summary from collected sources (not used to train models)
- Paddle — payments, tax and invoicing
- Cloudflare — bot protection
- Resend — transactional email
Some of these providers process data outside your country. They are bound by contracts with appropriate safeguards.
Your rights
Depending on where you live you can ask to access, correct, delete or export your data, object to processing, or complain to your data protection authority. You can delete your account and data yourself in My account, or contact us. We answer within 30 days.
Cookies
We only use cookies needed to run the service. See the Cookie policy.